Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 17:59
General
- Target c8db13c15ad99cc002dda644384e730497972a9995510918f5fc7e2c071b9a0f.exe
- Size 3.1MB
- Sample260522-wk12msct2r
- SHA256 c8db13c15ad99cc002dda644384e730497972a9995510918f5fc7e2c071b9a0f
Malware Config
Signatures
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8db13c15ad99cc002dda644384e730497972a9995510918f5fc7e2c071b9a0f.exe"C:\Users\Admin\AppData\Local\Temp\c8db13c15ad99cc002dda644384e730497972a9995510918f5fc7e2c071b9a0f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\WinSpecOS.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\WinSpecOS.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WinSpecOS.exe
memory/880-22-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-21-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-8-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-25-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-15-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-16-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-24-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-19-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-17-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-20-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-18-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-0-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/880-23-0x00007FF77B5C0000-0x00007FF77DF0B000-memory.dmp
memory/3396-7-0x00007FF7BC790000-0x00007FF7BF0DB000-memory.dmp
memory/3396-12-0x00007FF7BC790000-0x00007FF7BF0DB000-memory.dmp